Overview

overview

10

Static

static

5

38b36f7199...18.exe

windows7-x64

10

38b36f7199...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2024, 06:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    38b36f71998c3391faa39cbcfc7a173d_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    38b36f71998c3391faa39cbcfc7a173d

  • SHA1

    3e0f1cd2a65e69614abd0da404e8e4b99a2249ac

  • SHA256

    d26596eaf05f5aae4292ac12d822047e5c9d19ebbafe0b9a46faf5b5b1a4209b

  • SHA512

    3d6c8780f7d8f264323417bbadfb0d774f93fcc6a78c3e9d08bb69d4fc265fd80fe540881180f86ec63ddfaf62c2a20b25947d25faee0fb7c5681f15344a6c1b

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6m:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5/

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38b36f71998c3391faa39cbcfc7a173d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\38b36f71998c3391faa39cbcfc7a173d_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Windows\SysWOW64\vqoqtwexwp.exe
      vqoqtwexwp.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3892
      • C:\Windows\SysWOW64\dzrbgvqi.exe
        C:\Windows\system32\dzrbgvqi.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4872
    • C:\Windows\SysWOW64\xeipunbhnxkuoes.exe
      xeipunbhnxkuoes.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3024
    • C:\Windows\SysWOW64\dzrbgvqi.exe
      dzrbgvqi.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2052
    • C:\Windows\SysWOW64\wzwmymgwnqaru.exe
      wzwmymgwnqaru.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2328
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    cb9fe0cdd08d797fdb2637556f7c58c0

    SHA1

    c670b45d5b5252564e2cfa140479aad05608d105

    SHA256

    75939865d1a761ec4eec3e77bc649337a7ebfa97f2d332262bbc487fc2926ec0

    SHA512

    5c0347987db800ec875aa1eafdcac12fadcb130ec02c85f93825b0ee5e270d0f348b553b8556a0d38e6cab63497d59c7269c0330fd8ad39f6a00159b0dd29f56

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    47e3b6f6f7a200ed766f46b92f0552d9

    SHA1

    e837a1c7fb574bac7fe931fef9759e925468db48

    SHA256

    3f912bd39819808ff2718199feb0d409c9f312d717ab8538732398a5a4301665

    SHA512

    079fbbd5eb45e26054fab54c30b3bb7a671a199ebd76cb1286c4f433f6a5716bc4a81b387017490e494abfdeaf67d700881676945c50e5374675e39d00f5eba1

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    239B

    MD5

    361ba5cdfe246f4303b0a1638e0daf43

    SHA1

    eced7199b1af3c8e92209a68cb9a925ff3f369a3

    SHA256

    507143acb38e64408d03a0dd98e16bd34ca557294c466ae8ec9c7c763eb3a2a5

    SHA512

    81b9d124396d138717aea4dc71cec59426a3b65b47eaa0d13523adf030c5e3df9fa670ed48f7634d0301812d4b546dd43bc5bf863b58112570a2ab049bc7ab54

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl
    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    48ca34aded7b81c5c8c0fa218188ceb0

    SHA1

    bda6086cf3eb9c9ac6b99d247a2480517bb91c55

    SHA256

    3cf94beb5539d7f9a6925fa2855917026b6bb8290bf284bc1e5cf74da7b89eb7

    SHA512

    424ecc5c7d0d6ed1a8700606387a18cc4722bdf6aa657a7d9b949c3f49459960d2221210c24dd4edeb9382001d3f8068ffe16ce89b4b84c3083a7cf7011f0dc8

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    d52a5e5d0d05747b845ec9fbd68c80a6

    SHA1

    ab530c48fa34a031c6706bfd1b2178e013a3ac26

    SHA256

    4b3b57c0e71ed0d141b8aa2c34bb6c162eef5f72d1761e0ed34e2d433b170307

    SHA512

    852f132d109bd25ab7d925c679d9f444f1d6178b32da9d25df21388429953dfd485cf78274f9900f3c2d64afa1bc5a84fb59fff9df5028f31584b6e709db8d98

    Download Submit

  • C:\Windows\SysWOW64\dzrbgvqi.exe
    Filesize

    512KB

    MD5

    a683bc028f61a2244b5e878f2d5a04c7

    SHA1

    e4c4de1213e3ca686421a1e561da1ba32a3fe7f6

    SHA256

    c1b73801307a95fb43c3b16a719dc40b6d4f40930d94b729f17b7d5b4e9abda5

    SHA512

    dfda5bbfd903df701289ae48a82b4c37ea97ffd5a914f1521cd4574ef555b0f6dd5e384f1461aa92f1dc998d6499e8e218edf65b52ccb1b1945e603cb6179513

    Download Submit

  • C:\Windows\SysWOW64\vqoqtwexwp.exe
    Filesize

    512KB

    MD5

    408a053620e11aebd76ce6524e183a9e

    SHA1

    40668a91184cbec1e0b5123d399a55c07bd0ddfa

    SHA256

    40933df41fa710199a602574e7ea2cf26fc811c9243813b9d5891baaa8ca1178

    SHA512

    c993f84bb07eab122878e08801516f21dcfeb6bf22dca35297880412ebf62add63b1525909c40ca28b6f4be090dda248048823842ef151896535ab028c27056f

    Download Submit

  • C:\Windows\SysWOW64\wzwmymgwnqaru.exe
    Filesize

    512KB

    MD5

    9b12c1e767380c11dca1780e06cae4c1

    SHA1

    a43f9f255c0a31747fc23a34944477de7c0a740f

    SHA256

    248edecea5933ddcbd624437151cdb796b9f09e1a97658259c2967fbeaa2132b

    SHA512

    55f91e719f12e14edb1a702c17aa33f6f4f6c31754caaa89ed92ada0a02dd2eff28913d8eca9660ae4f096217ded60b08ff8937c23d54ccdea03ae66bf391b1a

    Download Submit

  • C:\Windows\SysWOW64\xeipunbhnxkuoes.exe
    Filesize

    512KB

    MD5

    6f2681c753b7893cd01a6cf2212eeb07

    SHA1

    4ec6f437cfc42e17e573df816059983be4b987e7

    SHA256

    95f068b3e3b59bfc59308b8480f1a13c3daca206e03c886cd77593563be1390c

    SHA512

    a9a6352ea570ee87b20473b74278f19be292bf4bcd400fd21b80f9502177e698f030f4ef0b6acb38bb586e2243e171dab1b60c0228a505f93f43cb69f3ab1579

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    1a272f1cfb5693ecd8befc56bade5626

    SHA1

    db2256df87c133012cc141b9f181d77005de2d7c

    SHA256

    5387e58275a460b082f388a773d72019301e9ff49e9fca6dd10eed15e588ef65

    SHA512

    257612ec302cd17435efc82430ef4c34f35ede32c41c19fc7754991a357b8605b3e3f084943ff946269570277f381ecb5456a62d5edf0c96b1346213e15876a0

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    c369dd33004a9907cc881e8ca42c7c79

    SHA1

    b9788418bb7bd3524e1cf20afecc0764e483b859

    SHA256

    a55462ce28cb34b7715b54df210fe52a7a4ed1923e57e9f080553e0de7ff4205

    SHA512

    f440567a51a9c87cfeea025afd5f250baa931566e928bbb4974791a787a9d8367d9ff8c899b7359472d5c485a79d57659661524dc8555bfd1b2d99c6c4549bfc

    Download Submit

  • memory/3656-47-0x00007FFE36AF0000-0x00007FFE36B00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3656-44-0x00007FFE36AF0000-0x00007FFE36B00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3656-39-0x00007FFE38E10000-0x00007FFE38E20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3656-38-0x00007FFE38E10000-0x00007FFE38E20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3656-36-0x00007FFE38E10000-0x00007FFE38E20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3656-37-0x00007FFE38E10000-0x00007FFE38E20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3656-35-0x00007FFE38E10000-0x00007FFE38E20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3656-593-0x00007FFE38E10000-0x00007FFE38E20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3656-594-0x00007FFE38E10000-0x00007FFE38E20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3656-596-0x00007FFE38E10000-0x00007FFE38E20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3656-595-0x00007FFE38E10000-0x00007FFE38E20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4284-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download